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Amendment 

Please replace all prior versions and listings of claims with the following listing of claims. 
Listing of Claims: 

1. (Currently Amended) A computer-implemented system for providing service level 
management in a network, wherein the network includes a plurality of network components, 
and wherein a service operates on a subset of the plurality of network components, the service 
having a state, the system comprising: 

multiple monitoring agents [[to]] that each monitor a respective aspect of operation of 
one or more of the network components, wherein each monitoring agent detects ono or moro 
events re l at i ve to in the respective monitored aspect of operation and generates alarms an 
a l arm as a function of the ono or more detected events; and 

an alarm correlation agent that receives the generated alarms from the monitoring 
agents, wherein the alarm correlation agent tlwt determines a current state of the service 
based on the received alarms or i g i nating from tho subset of the p l ura l ity of network 
components and , that issues one or more instructions to autonomously establish a des i red 
desirable state of the service when the current state of the service is undesirable. 

2. (Original) The system of claim 1, wherein the monitoring agents comprise at least one 
of: 

an infrastructure monitoring agent to monitor operation of the network infrastructure; 

a computer system monitoring agent to monitor operation of at least one computer 
system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 
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a response time monitoring agent to monitor a response time of a communication on 
the network; 

a device monitoring agent to monitor operation of a device on the network; and 
a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

3. (Currently Amended) The system of claim 1, wherein the monitoring agents and the 
alarm correlation agent agents comprise reasoning agents. 

4. (Original) The system of claim 3, wherein the reasoning agents comprise one or more 
of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

5. (Currently Amended) The system of claim 1, comprising: 

an alarm repository to roco i vo that receives the one or moro generated alarms from the 
monitoring agents, wherein the alarm correlation agent reads analyzes the alarms in the alarm 
repository. 

6. (Currently Amended) A computer-implemented system for providing service level 
management in a network, wherein the network includes a plurality of network components, 
and wherein a service operates on a subset of the plurality of network components, the service 
having a state, the system comprising: 

a first monitoring agent that monitors a respect i ve first aspect of operation of one or 
more of the network components, wherein the first monitoring agent detects detecting ono or 
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moro events re l ative to in the first monitored aspect of operation and generates alarms 
generating on a l arm as a function of the ono or moro detected events; 

a second monitoring agent that monitors a respective second aspect of operation of 
one or more of the network components, wherein the second aspect is different from the first 
aspect, and wherein the second monitoring agent detects detecting ono or more events 
re l at i ve to in the second monitored aspect of operation and generates alarms generating an 
a l arm as a function of the ono or more detected events; 

an alarm repository that receives the generated one or moro alarms from each of the 
first and second monitoring agents; and 

an alarm correlation agent that roads analyzes at least the one or moro received alarms 
in the alarm repository, and that determines a current state of the service based on from the 
read ono or moro analyzed alarms that or i g i nate from the subset of the p l ura li ty of network 
components, where i n the a l arm correlation agent i s operat i ve to i ssue , and issues one or more 
instructions to autonomously establish a des i red desirable state of the service when the 
current state of the service is undesirable. 

7-8. (Cancelled) 

9. (Currently Amended) The system of claim 6, wherein the first and second monitoring 
agents comprise at least one or moro of: 

an infrastructure monitoring agent to monitor operation of the network infrastructure; 

a computer system monitoring agent to monitor operation of at least one computer 
system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 
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a response time monitoring agent to monitor a response time of a communication on 
the network; 

a device monitoring agent to monitor operation of a device on the network; and 
a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

10. (Currently Amended) The system of claim 6, wherein the f i rst ond second monitoring 
agents and the alarm correlation agent comprise reasoning agents, wherein the reasoning 
agents comprise one or more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

11. (Currently Amended) A computer-implemented system for providing service level 
management in a network hov i ng ot l oost ono mon i toring agent to mon i tor at l east one aspect 
of operot i on and to generate an a l arm as a funct i on of one or more dotected events , wherein 
the network includes a plurality of network components[[,]] and at least one monitoring agent 
that monitors an aspect of operation of one or more of the network components, wherein the 
monitoring agent detects events in the monitored aspect of operation and generates alarms as 
a function of the detected events, and wherein a service operates on a subset of the plurality 
of network components, the service having a state, the system comprising: 

an alarm correlation agent that receives the generated alarms from the at l east ono 
monitoring agent , wherein the alarm correlation agent determines to determine a current 
state of the service based on the received alarms or i g i nat i ng from the subset of the p l ura li ty of 
network components and tJ=*a* issues one or more instructions to autonomously establish a 
des i red desirable state of the service when the current state of the service is undesirable. 



Page 5 of 15 



Application Serial No.: 09/578,156 
Attorney Docket No.: 019287-0317293 
Reply and Amendment Accompanying RCE 

12. (Currently Amended) The system of claim 11, wherein the alarm correlation agent 
comprises one or more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

13. (Currently Amended) A computer-implemented method of for providing service level 
management in a network, wherein the network includes a plurality of network components, 
and wherein a service operates on a subset of the plurality of network components, the service 
having a state, the method comprising: 

monitoring at least one aspect or more ospocts of operation of one or more of the 
network af*4 components; 

detecting ono or moro events re l at i ve to of in the ono or more aspects monitored 
aspect of operation; 

generating alarms an a l arm for a respective aspect of network operat i on as a function 
of the respective detected one or more events; 

analyzing determ i n i ng a re l ationsh i p between the generated ono or moro alarms af*4 
determ i n i ng to determine a current state of the service as a funct i on of the re l ationship 
between the ono or moro a l arms that orig i nate from the subset of the p l ura l ity of network 
components ; and 

issuing generat i ng one or more instructions to autonomously establish a des i red 
desirable state of the service when the current state of the service is undesirable. 

14. (Cancelled) 

15. (Currently Amended) The method according to claim 13, wherein the monitored 
aspects of operation include further compr i s i ng monitoring at least one of: 
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operation of the network infrastructure- 
operation of at least one computer system on the network; 
traffic on the network; 

operation of at least one application operating on the network; and 
operation of a trouble-ticketing agent process that receives reports of problems by 
users with respect to operation of the network; 
operation of a device on the network; 
a response time of a communication on the network; and 
an aggregate of any of the above aspects of operation . 

16. (Currently Amended) The method of claim 13, wherein the generating the alarms 
includes on a l arm compr i ses applying at least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
code book codobooks based reasoning; and 
case-based reasoning. 

17. (Currently Amended) The method of claim 13, wherein corre l at i ng analyzing the 
generated one or more alarms comprises includes applying at least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
code book codobooks based reasoning; and 
case-based reasoning. 

18. (Currently Amended) A computer-implemented method ef for providing service level 
management in a network, wherein the network includes a plurality of network components, 
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and wherein a service operates on a subset of the plurality of network components, the service 
having a state, the method comprising: 

monitoring a first aspect of operation of one or more of the network a&4 components; 

detecting ono or moro events rolativo to in the first monitored aspect of network 
operation; 

generating a first set of alarms as a function of the detected events in the first 
monitored aspect of operation; 

monitoring a second aspect of operation of one or more of the network components, 
wherein the second aspect is different from the first aspect[[, and]]; 

detecting ono or moro events ro l at i vo to iri the second monitored aspect of network 
operation; 

generat i ng a f i rst a l arm os a function of the detected ono or moro events ro l otivo to tho 
f i rst aspect of network operation; 

generating a second set of alarms a l arm as a function of the detected ono or moro 
events ro l at i vo to in the second monitored aspect of network operation; 

sending the generated first and second sets of alarms to an alarm repository; 

analyzing at least access i ng the first and second generated sets of alarms from in the 
alarm repository ; determining to determine a current state of the service as a funct i on of tho 
accessed first and socond a l arms that or i g i nate from the subset of tho p l ura l ity of network 
components ; and 

issuing generat i ng one or more instructions to autonomously establish a dosirod 
desirable state of the service when the current state of the service is undesirable. 

19. (Cancelled) 

20. (Currently Amended) The method of claim 18, wherein the one or more issued 
instructions control an aspect of operation of one or more of the network components . 

21. (Currently Amended) A computer program product compr i sing: 
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o computer readable medium having[[;]] computer program executable instructions 
recorded thereon on the computer readab l e medium , wherein the computer executable 
program instructions , when oxocutod by a computer, directs the are operable to direct a 
computer to perform a method ef for providing service level management in a network, 
wherein the network includes a plurality of network components, and wherein a service 
operates on a subset of the plurality of network components, the service having a state, the 
method comprising: 

monitoring at least one aspect or more aspects of operation of one or more of the 
network and components; 

detecting one or more events re l ative to in the monitored aspect one or more aspects 
of operation; 

generating alarms an a l arm for a respect i ve aspect of network operation as a function 
of the respect i ve detected one or more events; 

analyzing the generated determin i ng an association between the one or more alarms 
that or i g i nate from the subset of the p l ura li ty of network components and determining to 
determine a current state of the service as a function of the associat i on ; and 

issuing generat i ng one or more instructions to autonomously establish a des i red 
desirable state of the service when the current state of the service is undesirable. 

22. (Cancelled) 

23. (Currently Amended) A computer-implemented system for providing service level 
management in a network, wherein the network includes a plurality of network components, 
and wherein a service operates on a subset of the plurality of components, the service having a 
state, the system comprising: 

multiple monitoring agents that [[to]] each monitor a respective aspect of operation of 
one or more of the network components, wherein each monitoring agent detects one or more 
events re l at i ve to in the respective aspect of operation and generates alarms generate an 
a l arm as a function of the one or more detected eventsf [;ll ,each monitoring agent including: 
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each mon i toring agent inc l ud i ng an alarm correlation agent that receives the 
generated alarms in addition to ono or more alarms generated by from the other 
monitoring agents for consideration i n generating the o l orm as a funct i on of the ono or 
more detected events , wherein the alarm correlation agent determines a current state 
of the service based on the received alarms ; and 

each mon i tor i ng agent includ i ng a control agent that i ssues one or more 
i nstructions regarding controls the respective monitored aspect of operation , wherein 
the control agent issues one or more instructions regarding the controlled aspect of 
operation of the network i n order to autonomously establish a des i red desirable state 
of the service when the current state of the service is undesirable . 

24. (Previously Presented) The system of claim 23, wherein the monitoring agents 
comprise at least one of: 

an infrastructure monitoring agent to monitor operation of the network infrastructure; 

a computer system monitoring agent to monitor operation of at least one computer 
system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a communication on 
the network; 

a device monitoring agent to monitor operation of a device on the network; and 
a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

25. (Currently Amended) The system of claim 23, wherein the monitoring agents comprise 
reasoning agents, and wherein the reasoning agents comprise at least one of: 
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a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

26. (Currently Amended) A computer program product comprising: 

o computer readable medium having[[;]] computer program executable instructions 
recorded thereon on the computer readab l e medium , wherein the computer program 
executable instructions , when executed by a computer, are operable to direct each of a 
plurality of agents the computer to perform a method [[of]] for providing service level 
management in a network, wherein the network includes a plurality of network components, 
and wherein a service operates on a subset of the plurality of network components, the service 
having a state, the method comprising , for each of a p l ura li ty of agents;; 

monitoring at least one or more aspects of the respective aspect of operation of one or 
more of the network and components; 

detecting the one or more events relat i ve to in the respective monitored one or more 
aspects aspect of operation; 

generating an a l arm for the respect i ve aspect of network operation alarms as a function 
of the respective detected one or more events; 

communicating with the other agents to access events or alarms in the other respective 
monitored aspects of operation of the other mon i toring agent that orig i nate from the subset 
of the p l ura l ity of network components, and ; 

analyzing at least the generated alarms and the accessed events or alarms to determine 
determ i n i ng an existence of an assoc i at i on between those events or a l arms from other 
mon i toring agents in the a l arm generated for the respect i ve aspect of network operat i on and 
determ i n i ng a current state of the service as a funct i on of the association ; and 

issuing generat i ng one or more instructions to autonomously establish a desired 
desirable state of the service when the current state of the service is undesirable. 
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